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DETAILED ACTION 

1. Claims 1 -27 have been examined. 

Priority 

2. The application is filed on 11/28/2001 but claims the benefit of foreign priority has 
been made and acknowledged. 

3. Therefore, the effective filing date for the subject matter defined in the pending 
claims in this application is 11/28/2000 on the benefit of foreign priority date. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

1. Claims 1, 10, 12, 17 and 26 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Marvit et al. (US Patent 6625734) (hereinafter Marvit) in view of 

Patterson (US Patent 6389541) (hereinafter Patterson). 

Regarding to claim 1, Marvit teaches a method of transferring a data file having 

a file name from a first computer operated by a first user to a second computer operated 

by a second user, under control of a third computer, comprising the steps of: 
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i) in the first computer, the first user selecting a data file for transfer and 
establishing a communications link with the third computer (Marvit: see figure 1, column 
4 lines 10-26); 

ii) verifying an identity of the first user to the third computer by way of verification 
communications between the first and third computers (Marvit: see figure 1, column 5 
lines 16-35); 

iv) transmitting the file name of the data file from the first computer to the third 
computer, together with first user identification information and the unique key code 
(Marvit: column 4 lines 38-47 and column 5 lines 35-42); 

vi) verifying an identity of the second user to the third computer by way of 
verification communications between the second and third computers (Marvit: see figure 
1, column 5 lines 22-35); 

vii) upon successful verification of the identity of the second user, transmitting 
the file name of the data file from the second computer to the third computer with a 
request for the unique key code (Marvit: see figure 1, column 5 lines 57-67 and column 
6 lines 1-4); and 

iii) Marvit teaches in the first computer encrypting the data file and transmitting 
the encrypted data file directly to the second computer with user identification 
information and the file name of the data file (Marvit: see figure 1, column 5 lines 22-27 
and lines 35-56), Marvit does not explicitly disclose wrapping or encrypting the data file 
within an executable file adapted to unwrap or decrypt the data file only upon activation 
by a unique key code. However, Patterson teaches wrapping or encrypting the data file 
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within an executable file adapted to unwrap or decrypt the data file only upon activation 
by a unique key code (Patterson: column 8 lines 7-19 and lines 49-67 and column 9 
lines 1-18); 

v) Marvit teaches in the second computer, upon receipt of the wrapped or 
encrypted data file and upon attempted access thereto by the second user, establishing 
a communications link with the third computer (Marvit: see figure 1, column 5 lines 22- 
35 and lines 57-67 and column 6 lines 1-4). Marvit does not explicitly disclose the 
executable file containing the wrapped or encrypt data file, however Patterson teaches 
the executable file containing the wrapped or encrypt data file (Patterson: column 8 
lines 7-19); 

viii) Marvit teaches transmitting the unique key code from the third computer to 
the second computer to unwrap or decrypt the data file and to allow access thereto in 
the second computer by the second user (Marvit: column 5 lines 57-67 and column 6 
lines 1-4). Marvit does not explicitly disclose the unique key code causes the 
executable file to unwrap or decrypt the data file. However, Patterson teaches the 
unique key code causes the executable file to unwrap or decrypt the data file 
(Patterson: column 8 lines 7-19 and lines 49-67 and column 9 lines 1-8). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Patterson as stated above with the secure 
file transfer method and system of Marvit for wrapping the data file within the executable 
file because multimedia files may require significant time to download from the server 
on which they reside, due to the large size of the files and limited bandwidth of the 
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network over which they must be sent. Thus, browsing the Web in real-time for viewing 
of digital content such as newspapers and movies may not be desirable or practical for 
many users. An alternative method is to package the content in a compressed, 
encrypted, self-extracting format and deliver it to the user's computer, and after the user 
has paid for the object, to allow access to the content at the user's computer (Patterson: 
column 8 lines 7-19). 

Regarding to claim 10, Marvit in view of Patterson teaches wherein the third 
computer maintains a record of transactions between the first, second and third 
computers so as to permit an audit trail to be established (Marvit: column 3 lines 11-56). 

Regarding to claim 12, this claim has limitations that is similar to those of claim 
1, thus it is rejected with the same rationale applied against claim 1 above. 

Regarding to claim 17, this claim has limitations that is similar to those of claim 

1, thus it is rejected with the same rationale applied against claim 1 above. 

Regarding to claim 26, the rejection of claim 17 is incorporated and further this 
claim has limitation that is similar to those of claim 10, thus it is rejected with the same 
rationale applied against claim 10 above. 

2. Claims 2-7, 11, 13, 18-23 and 27 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Marvit in view of Patterson, and further in view of Goldfine et al (US 
Patent 5343529) (hereinafter Goldfine). 

Regarding to claim 2, Marvit in view of Patterson does not explicitly disclose 
wherein the identity of the first user is verified in step ii) above by way of the first user 
applying a first user mask code to a pseudo-random security string in the first computer 
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so as to generate a first user volatile identification code, the first user transmitting the 
first user volatile identification code to the third computer and the third computer 
comparing the first user volatile identification code with a first check volatile 
identification code obtained by applying the first user mask code to the pseudo-random 
string in the third computer, identity verification taking place when the first user volatile 
identification code and the first check volatile identification codes are found to match 
each other. 

However, Goldfine teaches wherein the identity of the first user is verified in step 
ii) above by way of the first user applying a first user mask code to a pseudo-random 
security string in the first computer so as to generate a first user volatile identification 
code, the first user transmitting the first user volatile identification code to the third 
computer and the third computer comparing the first user volatile identification code with 
a first check volatile identification code obtained by applying the first user mask code to 
the pseudo-random string in the third computer, identity verification taking place when 
the first user volatile identification code and the first check volatile identification codes 
are found to match each other (Goldfine: column 4 lines 25-53). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for verifying user’s identity by applying a mask code to a 
pseudo-random security string to generate a volatile identification code because 
hackers seeking access to telecommunication and computer networks program their 
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computers to try thousands of access codes in an attempt to find one that works. Once 
a successful code is found, the hacker can gain network access. Similar problems will 
exist for emerging interactive television services, such as entertainment and home 
shopping. Authentication techniques that use repeatedly transmitted access codes are 
susceptible to various sophisticated attacks. Some technique is needed to keep the 
attackers off balance. (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 3, Marvit in view of Patterson does not explicitly teach 
wherein the identity of the second user is verified in step vi) above by way of the second 
user applying a second user mask code to a first pseudo-random security string in the 
second computer so as to generate a second user volatile identification code, the 
second user transmitting the second user volatile identification code to the third 
computer and the third computer comparing the second user volatile identification code 
with a second check volatile identification code obtained by applying the second user 
mask code to a second pseudo-random string in the third computer, identity verification 
taking place when the second user volatile identification code and the second check 
volatile identification codes are found to match each other. 

However, Goldfine teaches wherein the identity of the second user is verified in 
step vi) above by way of the second user applying a second user mask code to a first 
pseudo-random security string in the second computer so as to generate a second user 
volatile identification code, the second user transmitting the second user volatile 
identification code to the third computer and the third computer comparing the second 
user volatile identification code with a second check volatile identification code obtained 
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by applying the second user mask code to a second pseudo-random string in the third 
computer, identity verification taking place when the second user volatile identification 
code and the second check volatile identification codes are found to match each other 
(Goldfine: column 4 lines 25-53). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for verifying user’s identity by applying a mask code to a 
pseudo-random security string to generate a volatile identification code because 
hackers seeking access to telecommunication and computer networks program their 
computers to try thousands of access codes in an attempt to find one that works. Once 

/ 

a successful code is found, the hacker can gain network access. Similar problems will 
exist for emerging interactive television services, such as entertainment and home 
shopping. Authentication techniques that use repeatedly transmitted access codes are 
susceptible to various sophisticated attacks. Some technique is needed to keep the 
attackers off balance (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 4, Marvit in view of Patterson does not explicitly disclose 
wherein the first pseudo-random security string and the second pseudo-random security 
string are the same. 

However, Goldfine teaches wherein the first pseudo-random security string and 
the second pseudo-random security string are the same (Goldfine: see figure 2, column 
6 lines 29-55). 
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At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for verifying user’s identity wherein the first pseudo-random 
security string and the second pseudo-random security string are the same because 
using the first and second string to produce an authentication code which authenticates 
a transaction request in order to permit progress of a transaction based on a match 
(Goldfine: column 1 lines 9-11). 

Regarding to claim 5, Marvit in view of Patterson does not explicitly disclose 
wherein the pseudo-random string is generated by the third computer and transmitted 
firstly to the first computer and then from the first computer to the second computer. 

However, Goldfine teaches wherein the pseudo-random string is generated by 
the third computer and transmitted firstly to the first computer and then from the first 
computer to the second computer (Goldfine: see figure 2, column 4 lines 25-53). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for verifying user’s identity by sending the pseudo-random 
string from the third computer to the first and from first to the second because hackers 
seeking access to telecommunication and computer networks program their computers 
to try thousands of access codes in an attempt to find one that works. Once a 
successful code is found, the hacker can gain network access. Similar problems will 
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exist for emerging interactive television services, such as entertainment and home 
shopping. Authentication techniques that use repeatedly transmitted access codes are 
susceptible to various sophisticated attacks. Some technique is needed to keep the 
attackers off balance (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 6, Marvit in view of Patterson does not explicitly disclose 
wherein the pseudo-random string is generated by the third computer and transmitted 
firstly to the first computer and then from the third computer to the second computer. 

However, Goldfine teaches wherein the pseudo-random string is generated by 
the third computer and transmitted firstly to the first computer and then from the third 
computer to the second computer (Goldfine: see figure 2, column 6 lines 29-68 and 
column 7 lines 1-23). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for verifying user’s identity wherein the pseudo-random string is 
generated by the third computer and transmitted firstly to the first computer and then 
from the third computer to the second computer because hackers seeking access to 
telecommunication and computer networks program their computers to try thousands of 
access codes in an attempt to find one that works. Once a successful code is found, 
the hacker can gain network access. Similar problems will exist for emerging interactive 
television services, such as entertainment and home shopping. Authentication 
techniques that use repeatedly transmitted access codes are susceptible to various 
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sophisticated attacks. Some technique is needed to keep the attackers off balance 
(Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 7, Marvit in view Patterson does not explicitly disclose 
wherein the first pseudo-random security string and the second pseudo-random security 
string are different. 

However, Goldfine teaches wherein the first pseudo-random security string and 
the second pseudo-random security string are different (Goldfine: column 6 lines 29-68 
and column 7 lines 1-23). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for verifying user’s identity wherein the first pseudo-random 
security string and the second pseudo-random security string are different because 
hackers seeking access to telecommunication and computer networks program their 
computers to try thousands of access codes in an attempt to find one that works. Once 
a successful code is found, the hacker can gain network access. Similar problems will 
exist for emerging interactive television services, such as entertainment and home 
shopping. Authentication techniques that use repeatedly transmitted access codes are 
susceptible to various sophisticated attacks. Some technique is needed to keep the 
attackers off balance (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 11, Marvit in view of Patterson teaches wherein the first 
and/or second user volatile identification codes are stored as digital signatures in the 
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third computer in combination with the associated pseudo-random security string 
(Marvit: column 17 lines 42-59). 

Regarding to claim 13, the rejection of claim 12 is incorporated and further this 
claim has limitation that is similar to those of claim 2, thus it is rejected with the same 
rationale applied against claim 2 above. 

Regarding to claim 16, Marvit in view of Patterson teaches a method of 

transferring a data file to a first computer having a first telecommunications address 

\ 

from a second computer having a second telecommunications address, comprising the 
steps of: 

i) transmitting a request for the data file from the first computer to the second 
computer, the request including data identifying the data file and the first 
telecommunications address (Marvit: see figure 1, column 4 lines 38-40 and column 8 
lines 20-27); 

ii) in the second computer, wrapping or encrypting the data file within an 
executable file adapted to unwrap or decrypt the data file only upon activation by a 
unique key code (Patterson: column 8 lines 7-19 and lines 49-67 and column 9 lines 1- 
18); 

iii) assigning a unique identification string to the executable file in the second 
computer, the unique identification string being further associated in the second 
computer with the first telecommunications address (Patterson: see figure 5, column 8 
lines 20-63); 
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iv) transmitting the executable file (containing the data file) and the unique 
identification string from the second computer to the first computer (Patterson: see 
column 8 lines 36-48); 

xi) transmitting the key code to the first computer so as to enable the executable 
file to unwrap or decrypt the data file and to install this on the first computer (Marvit: 
column 12 lines 47-67 and column 13 lines 1-2). 

Marvit in view Patterson does not explicitly disclose wrapping the data file within 
the executable file and verifying user’s identity by combining the pseudo-random string 
with a mask code to generate a volatile identification code. However, Goldfine teaches: 

v) causing a message to be displayed by the first computer showing the unique 
identification string and requesting a user to call a predetermined telephone number 
from a telephone operated by the user (Goldfine: column 4 lines 25-44); 

vi) receiving a telephone call from the telephone operated by the user, 
determining its telephone number and receiving the unique identification string from the 
user (Goldfine: column 4 lines 25-44); 

vii) in the second computer, generating a pseudo-random string, associating the 
pseudo-random string with the unique identification string and the telephone number of 
the telephone operated by the user, and transmitting the pseudo-random string to the 
telephone operated by the user (column 4 lines 25-53); 

viii) applying a mask code, known to the user and to the second computer, to the 
pseudo-random identification string so as to generate a volatile identification code in 
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accordance with predetermined rules (Goldfine: column 6 lines 29-68 and column 7 
lines 1-23); 

ix) transmitting the volatile identification code to the second computer, either 
from the telephone operated by the user in which case the volatile identification code is 
transmitted together with the telephone number of the telephone operated by the user, 
or from the first computer in which case the volatile identification code is transmitted 
together with the first telecommunications address, the telephone number or the first 
telecommunications address respectively serving to identify the first computer, the user 
and the executable file (Goldfine: column 4 lines 40-53); 

x) in the second computer, checking that the volatile identification code matches 
a volatile identification code generated therein by applying the mask code to the 
pseudo-random string and (Goldfine: column 4 lines 45-53 and column 6 lines 29-55), if 
so; 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for wrapping the data file within the executable file and verifying 
user’s identity by applying a mask code to a pseudo-random security string to generate 
a volatile identification code because hackers seeking access to telecommunication and 
computer networks program their computers to try thousands of access codes in an 
attempt to find one that works. Once a successful code is found, the hacker can gain 
network access. Similar problems will exist for emerging interactive television services, 
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such as entertainment and home shopping. Authentication techniques that use 
repeatedly transmitted access codes are susceptible to various sophisticated attacks. 
Some technique is needed to keep the attackers off balance (Goldfine: column 1 lines 
64-67 and column 2 lines 1-5). 

Regarding to claim 18, the rejection of claim 17 is incorporated and further this 
claim has limitation that is similar to those of claim 2, thus it is rejected with the same 
rationale applied against claim 2 above. 

Regarding to claim 19, the rejection of claim 18 is incorporated and further this 
claim has limitation that is similar to those of claim 3, thus it is rejected with the same 
rationale applied against claim 3 above. 

Regarding to claim 20, the rejection of claim 19 is incorporated and further this 
claim has limitation that is similar to those of claim 4, thus it is rejected with the same 
rationale applied against claim 4 above. 

Regarding to claim 21, the rejection of claim 20 is incorporated and further this 
claim has limitation that is similar to those of claim 5, thus it is rejected with the same 
rationale applied against claim 5 above. 

Regarding to claim 22, the rejection of claim 20 is incorporated and further this 
claim has limitation that is similar to those of claim 6, thus it is rejected with the same 
rationale applied against claim 6 above. 

Regarding to claim 23, the rejection of claim 19 is incorporated and further this 
claim has limitation that is similar to those of claim 7, thus it is rejected with the same 
rationale applied against claim 7 above. 
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Regarding to claim 27, the rejection of claim 18 is incorporated and further this 
claim has limitation that is similar to those of claim 11, thus it is rejected with the same 
rationale applied against claim 11 above. 

3. Claims 8, 14 and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Marvit in view of Patterson, and further in view of Wilfong U.S. Patent 5754652 
(hereinafter Wilfong). 

Regarding to claim 8, Marvit in view of Patterson does not explicitly disclose: 

i) said secure user code entry interface contains at least one active display for 
entry of at least one digit of said user mask code by the user; wherein said active 
display illuminates or highlights at least one display digit within said active display and 
said user enters said at least one digit of said user mask code by a response through an 
input device at a response time when said at least one display digit which corresponds 
with said at least one digit of said user mask code is illuminated or highlighted in said 
active display; and 

ii) a random run on time is added to said response time to extend said at least 
one active display. 

However, Wilfong teaches i) said secure user code entry interface contains at 
least one active display for entry of at least one digit of said user mask code by the 
user; wherein said active display illuminates or highlights at least one display digit within 
said active display and said user enters said at least one digit of said user mask code 
by a response through an input device at a response time when said at least one 
display digit which corresponds with said at least one digit of said user mask code is 
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illuminated or highlighted in said active display (Wilfong: column 2 lines 28-41); and ii) a 
random run on time is added to said response time to extend said at least one active 
display (Wilfong: column 2 lines 28-41). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Wilfong as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson for verifying user’s identity by using an active display to capture 
the PIN number of user at a response time because the system prompts are made in 
such a way as not to be observable by bystanders (Wilfong: column 2 lines 32-34). 

Regarding to claim 14, the rejection of claim 12 is incorporated and further this 
claim has limitations that is similar to those of claim 8, thus it is rejected with the same 
rationale applied against claim 8 above. 

Regarding to claim 24, the rejection of claim 17 is incorporated and further this 
claim has limitations that is similar to those of claim 8, thus it is rejected with the same 
rationale applied against claim 8 above. 

4. Claims 9, 15 and 25 are is rejected under 35 U.S.C. 103(a) as being 
unpatentable over Marvit in view Patterson in view of Goldfine, and further in view of 
Girolomo Cardano (hereinafter Grilles). 

Regarding to claim 9, Marvit in view of Patterson in view of Goldfine does not 
explicitly disclose: 

i) the pseudo-random string comprises a first linear array of characters, each 
character having a given numerical position in the first array (first, second, third etc.); 
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ii) the mask code comprises a second linear array of numbers, each number 
having a given numerical position in the second array (first, second, third etc.); and 

iii) the volatile identification code is generated by applying the mask code to the 
pseudo-random string so as sequentially to select numerical positions in the first array 
on the basis of the numbers in the second array, taken in positional order, and to return 
the characters thereby selected from the first array in sequence so as to form a third 
linear array, this third linear array forming the volatile identification code. 

However, Grilles teaches: 

i) the pseudo-random string comprises a first linear array of characters, each 
character having a given numerical position in the first array (first, second, third etc.) 
(Grilles: “Cardano Grilles” pages 1-3); 

ii) the mask code comprises a second linear array of numbers, each number 
having a given numerical position in the second array (first, second, third etc.) (Grilles: 
“Cardano Grilles” pages 1-3); and 

iii) the volatile identification code is generated by applying the mask code to the 
pseudo-random string so as sequentially to select numerical positions in the first array 
on the basis of the numbers in the second array, taken in positional order, and to return 
the characters thereby selected from the first array in sequence so as to form a third 
linear array, this third linear array forming the volatile identification code (Grilles: 
“Cardano Grilles” pages 1-3). 

It would have been obvious to a person having ordinary skill in the art at the time 
the invention was made to have applied the teaching of Grilles into the combination of 
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Marvit, Patterson and Goldfine’s invention to calculate the third array by applying the 
first array to the second. The ordinary skilled person would have been motivated to 
make modification to Marvit in view of Patterson in view of Goldfine because the idea 
here is to mask the selection of the numerical positions of the first array on the basis of 
the numbers in the second array to product the third array. This method is well known 
in the art and it is easy to implement in C++ or Java programming environment. 

Regarding to claim 15, the rejection of claim 13 is incorporated and further this 
claim has limitation that is similar to those of claim 9, thus it is rejected with the same 
rationale applied against claim 9 above. 

Regarding to claim 25, the rejection of claim 18 is incorporated and further this 
claim has limitation that is similar to those of claim 9, thus it is rejected with the same 
rationale applied against claim 9 above. 

Response to Arguments 

5. Applicant's arguments filed 02/21/ 2006, with respect to the rejection(s) of 
claim(s) 1-27 under Pensak (US Patent 6289450) in view of Marvit in view of Goldfine in 
view of Wilfong in view of Bostley in view of Grilles been fully considered and are 
persuasive. Therefore, the rejection has been withdrawn. However, upon further 
consideration, a new ground(s) of rejection is made in view of Marvit in view of 
Patterson in view of Goldfine in view of Wilfong in view of Grilles. 

6. The applicant has amended claims 7 and 23; therefore the examiner withdraws 


the 112, 2 nd paragraph rejection. 
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Application/Control Number: 09/994,919 
Art Unit: 2131 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Trang Doan whose telephone number is (571) 272- 
0740. The examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner’s 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 

Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 


Trang Doan 
Examiner 
Art Unit 2131 


T.D. 

May 5, 2005 
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